A modern computer network comprises a large amount of highly distributed nodes and data. The highly distributed data can be very difficult to be collected and analyzed. Further, information gathered from the highly distributed throughout the network is often limited and may not include certain types of useful information. For example, data traffic may not always include identifications of the node's server-client status. Thus, there is a need to make an estimate or inference as to the server-client status of a network node based on gathered data traffic information.